Guccifer

Background

Marcel Lehel Lazăr was born on November 23, 1971, and is of Romanian and Hungarian ancestry. He grew up and lived in the village of Sâmbăteni, part of the Păuliș commune, located to the east of Arad, Romania. At the time of his arrest in 2014, he was working as an unemployed taxi driver with no formal background in computer science or cybersecurity.

His online pseudonym, Guccifer, is a portmanteau of "Gucci" and "Lucifer" — a combination he described as referencing "the style of Gucci and the light of Lucifer."

Hacking Activities

Lazăr's method was notably low-tech. He possessed no specialized equipment beyond a basic NEC desktop computer and a Samsung cellphone, and relied on publicly available information to guess the answers to security questions protecting his targets' accounts. Through patience and trial and error, he was able to compromise accounts on AOL, Yahoo!, Flickr, and Facebook.

He first attracted widespread media attention in February 2013, when The Smoking Gun reported that he had hacked the AOL account of Dorothy Bush Koch, sister of former president George W. Bush. The breach exposed family photographs of former president George H. W. Bush, who was hospitalized at the time, and a self-portrait painted by George W. Bush, both of which circulated online.

Lazăr subsequently hacked the website and email correspondence of former Secretary of State Colin Powell, accessing years of communications that included exchanges with George Tenet, Richard Armitage, and John Negroponte, as well as personal financial information. He also gained access to the email account of Romanian politician Corina Crețu after six months of guessing her password, and through her account accessed her correspondence with Powell.

Other targets included U.S. Senator Lisa Murkowski, members of the Rockefeller family, former FBI and Secret Service agents, a senior United Nations official, CBS sportscaster Jim Nantz, and author Candace Bushnell, among others. In the case of Bushnell, he posted portions of an unpublished manuscript to her Twitter feed while she attempted to regain control of her accounts.

On March 20, 2013, USA Today reported that Lazăr had hacked the email account of Sidney Blumenthal, a former aide to President Bill Clinton, and distributed private memos addressed to Secretary of State Hillary Clinton concerning events in Libya, including the September 11, 2012 Benghazi attack. He reformatted the documents with pink backgrounds and Comic Sans font before releasing them publicly.

In early May 2013, he also compromised online accounts belonging to members of the Council on Foreign Relations and accounts associated with economist Adam Posen and a former Federal Reserve Board official.

Earlier Criminal Record

Prior to his high-profile breaches, Lazăr had already accumulated a criminal record in Romania. In 2011, operating under the pseudonym Micul Fum ("Little Smoke"), he was arrested and convicted for hacking the email accounts of Romanian celebrities and was serving a separate three-year sentence for those offenses at the time of his 2014 arrest.

Prosecutions and Imprisonment

On January 22, 2014, Romanian law enforcement agency DIICOT arrested Lazăr at his home in Sâmbăteni, Arad County. A Romanian court subsequently sentenced him to four years in jail for accessing the email accounts of public figures with the intent to obtain confidential data, bringing his combined Romanian sentence to seven years.

On June 12, 2014, a U.S. federal grand jury in the Eastern District of Virginia indicted Lazăr on nine charges, including wire fraud, unauthorized access to protected computers, aggravated identity theft, cyberstalking, and obstruction of justice. The indictment covered hacking activity from December 2012 through January 2014.

In March 2016, Romania approved an 18-month temporary extradition, and Lazăr was surrendered to U.S. authorities. He made his first U.S. court appearance on April 1, 2016, and was held at Alexandria City Jail in Alexandria, Virginia.

On May 25, 2016, Lazăr pleaded guilty to unauthorized access to a protected computer and aggravated identity theft. In his statement of facts, he admitted to intentionally gaining unauthorized access to approximately 100 Americans' personal email and social media accounts between October 2012 and January 2014.

On September 1, 2016, U.S. District Judge James C. Cacheris sentenced Lazăr to 52 months in federal prison. Romania's Justice Ministry requested that he be returned to Romania to complete his sentence there before being conditionally released and returned to the United States. He was released from prison in August 2021.

Notable Claim

While detained in Virginia in May 2016, Lazăr publicly claimed to have repeatedly hacked Hillary Clinton's private email server, describing it as easy to access. U.S. investigators found no evidence to support the claim. According to an FBI report, Lazăr stated during interrogation that he had lied to Fox News when making the claim, and investigators concluded that while he may have attempted to access the server, no forensic evidence confirmed a successful breach.